What is CVE-2026-12704?

CVE-2026-12704 is a security advisory published by Grafana Labs Security. SAML assertion replay via skipped InResponseTo validation

Why does CVE-2026-12704 have no CVE ID yet?

Grafana Labs Security published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by CVE-2026-12704?

CVE-2026-12704 affects 2 products, including: Grafana Enterprise; Grafana OSS.

CVE-2026-12704Disclosed before NVD

SAML assertion replay via skipped InResponseTo validation

Vendor

Grafana Labs Security

Published

September 2, 2026

Last Modified

—

📋 Description

When SAML IdP-initiated login is enabled in Grafana Enterprise, the SAML library skips validation of the InResponseTo field on all SAML responses, including SP-initiated logins. This removes anti-replay protection, allowing an attacker who obtains a valid signed SAML assertion to replay it and gain a session as the victim user. Only instances with the allow_idp_initiated SAML setting enabled are affected; this setting is off by default and Grafana OSS is not affected.

🎯 Affected products2

Grafana Enterprise
Grafana OSS

🔗 References (1)

advisoryhttps://grafana.com/security/security-advisories/cve-2026-12704/